Weak password reset in Supabase
Use Supabase Auth's reset email from the client or server, with a redirectTo URL on an allowlist you configured in the Auth settings. The redirect page should exchange the token through the Supabase client session flow, then call the password update on that session.
Fix for Supabase
Use Supabase Auth's reset email from the client or server, with a redirectTo URL on an allowlist you configured in the Auth settings. The redirect page should exchange the token through the Supabase client session flow, then call the password update on that session. Do not write a custom update users set password from a service-role query that trusts an email field in the body.
Confirm the redirect URL allowlist does not contain *. An open redirect on the reset link can send the token to another site. Keep the allowlist to your real origins.
The five-minute check, the other platforms, and the agent prompt are on the full guide. More Supabase fixes are on the Supabase page.